Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- cli.mjs:666
- Evidence
const result = spawnSync(command, args, {
Security audit
TeamClaw
Security checks across malware telemetry and agentic risk
Overview
TeamClaw’s virtual-team features are mostly consistent with its description, but it can automatically launch worker agents, install additional skills, and pass environment access to workers, so it should be reviewed carefully before use.
Install only if you are comfortable running a multi-agent orchestration service that can start workers, coordinate over the network, use Git, and potentially install additional skills on workers. Begin with local-only mode, disable on-demand provisioning and Git publishing until needed, use isolated workspaces, and carefully limit any environment variables or credentials available to worker agents.
VirusTotal
VirusTotal engine telemetry is currently stale for this artifact.
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/controller/local-worker-manager.ts:223
- Evidence
const child = spawn(process.execPath, [
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/controller/worker-provisioning.ts:685
- Evidence
const child = spawn(process.execPath, [
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/git-collaboration.ts:648
- Evidence
const child = spawn(command, args, {
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/worker/skill-installer.ts:60
- Evidence
const child = spawn(command, args, {
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- src/controller/local-worker-manager.ts:234
- Evidence
...process.env,
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- src/git-collaboration.ts:651
- Evidence
...process.env,
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- src/identity.ts:63
- Evidence
const requestedWorkerId = process.env.TEAMCLAW_WORKER_ID?.trim() || undefined;